Alt-F-0.1RC1 OpenVPN

2,303 views
Skip to first unread message

Cam1878

unread,
Oct 16, 2011, 4:14:01 PM10/16/11
to Alt-F
Hi,

I'm trying to use the openvpn package that is included in the RC1
release. I have made the configuration files and keys on a linux VM
but I do not know how to start the vpn server on my DNS-323.

I can telnet and SSH to the box but I do not know which commands to
use to set up the openvpn server or load the .conf files (also where
to save them on my NAS).

I have tried looking on the forum but none of the threads are recent
and don't apply to the recent release.

Can anyone provide a step-by-step method of getting it to work?

Thanks

Joao Cardoso

unread,
Oct 17, 2011, 10:14:58 AM10/17/11
to Alt-F
I can't help you with openvpn setup, as I never used it. I only made
the functional checks recommended in the INSTALL file.
I would like to provide full openvpn configuration support on Alt-F,
with your help.
But we will do that on a second stage, if you agree.

First you have to make sure that your certificates and configuration
are working.

Start creating the place where certificates and configuration files
will be:

mkdir /etc/openvpn

and copy the certificates and configuration file to there.

Load the kernel driver:

modprobe tun

perhaps openvpn loads it for you, You have to figure out this latter.

Now start openvpn with the correct options. I don't know what to use,
you have to follow a tutorial.

openvpn --config /etc/openvpn/yourconfigfile --other needed
options?

Test it's working, and when everything it fine, let's automate it's
Alt-F working. Do the following:

ln -sf /usr/sbin/rcscript /sbin/rcopenvpn

and create a file /etc/init.d/S41openvpn with the following content

-----------------------------8<------------------------------------------
#!/bin/sh

DESC="openvpn daemon"
NAME=openvpn
TYPE=net

OPENVPN_OPTS="--config /etc/openvpn/yourconfigfile --other needed
options?"

. $(dirname $0)/common

case "$1" in
start) start $NAME -- $OPENVPN_OPTS
stop) stop $NAME ;;
status) status $NAME ;;
reload) reload $NAME ;; # can openvpn re-read configuration
file changes?
restart) restart $NAME ;;
*) usage $0 "start|stop|status|restart|reload" ;;

-----------------------------
>8------------------------------------------

There are other initscripts in the /etc/init.d directory, you might
have to look at then.
What other service, if any, has to be running for openvpn to work?

And that's all (for now)

You can now use and verify the commands

rcopenvpn start
rcopenvpn stop
rcopenvpn status
rcopenvpn reload # after configuration file changes

also, in Services->Network an openvpn entry shall appear

Did it work?
Can you share the configuration and how it was created? Posting the
original and the modified files is important.

The samples and easy-rsa directory is located in /usr/share/openvpn/,
can it be used to create certificates in the box? How to use them?
(Start first with certificates created on another linux box, where
openvpn is known to work.)

Thanks,
Joao

Cam1878

unread,
Oct 17, 2011, 11:58:33 AM10/17/11
to Alt-F
I followed the openvpn how-to found here:
http://openvpn.net/index.php/open-source/documentation/howto.html

(I'm not an expert on openvpn, I'm learning this as I go)

I used the DNS-323 to create the keys because it already contained the
easy-rsa folder and all of the files to do it. (I had done it using a
ubuntu VM on my PC, but they result in identical files)

I used the default server.conf file found in the sample folder since I
haven't modified it yet.

#modprobe tun

did not return any sort of error

#openvpn --config /etc/openvpn/server.conf

generated the following:

Mon Oct 17 10:30:07 2011 OpenVPN 2.2.1 arm-linux [SSL] [LZO2] [EPOLL]
[eurephia] built on Oct 12 2011
Mon Oct 17 10:30:07 2011 NOTE: your local LAN uses the extremely
common subnet address 192.168.0.x or 192.168.1.x. Be aware that this
might create routing conflicts if you connect to the VPN server from
public locations such as internet cafes that use the same subnet.
Mon Oct 17 10:30:07 2011 NOTE: OpenVPN 2.1 requires '--script-security
2' or higher to call user-defined scripts or executables
Mon Oct 17 10:30:07 2011 Diffie-Hellman initialized with 1024 bit key
Mon Oct 17 10:30:07 2011 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0
ET:0 EL:0]
Mon Oct 17 10:30:07 2011 Socket Buffers: R=[108544->131072] S=[108544-
>131072]
Mon Oct 17 10:30:07 2011 ROUTE default_gateway=192.168.0.1
Mon Oct 17 10:30:07 2011 Note: Cannot open TUN/TAP dev /dev/net/tun:
No such file or directory (errno=2)
Mon Oct 17 10:30:07 2011 /sbin/ifconfig 10.8.0.1 pointopoint 10.8.0.2
mtu 1500 ifconfig: SIOCSIFADDR: No such device
Mon Oct 17 10:30:07 2011 Linux ifconfig failed: external program
exited with error status: 1
Mon Oct 17 10:30:07 2011 Exiting

Your guess is as good as mine when it comes to which files are
missing.

From a bit of googling SIOCSIFADDR, it is to do with a network
interface being missing in the ifconfig file, I assume this is because
the TUN interface was not initialized because the TAP/TUN files are
missing.
There is a similar problem here: http://openvpn.net/archive/openvpn-users/2007-05/msg00304.html
The TAP/TUN was not run due to a permission error then that error
showed up.

I would like to have a TAP (bridging) VPN, but I'll try to get the
default working first, then I'll change the .conf file.

Cam1878

unread,
Oct 17, 2011, 12:14:13 PM10/17/11
to Alt-F
I followed the solution here: http://wiki.vpslink.com/TUN/TAP_device_with_OpenVPN_or_Hamachi
To create the TUN files.

I re-ran the openvpn --config and had a new error. I currently have
the dh1024.pem file in the same directory as the server.conf file and
the server keys. I'll post again if I figure out what is wrong.

# openvpn --config /etc/openvpn/server.conf
Mon Oct 17 11:08:41 2011 OpenVPN 2.2.1 arm-linux [SSL] [LZO2] [EPOLL]
[eurephia] built on Oct 12 2011
Mon Oct 17 11:08:41 2011 NOTE: your local LAN uses the extremely
common subnet address 192.168.0.x or 192.168.1.x. Be aware that this
might create routing conflicts if you connect to the VPN server from
public locations such as internet cafes that use the same subnet.
Mon Oct 17 11:08:41 2011 NOTE: OpenVPN 2.1 requires '--script-security
2' or higher to call user-defined scripts or executables
Mon Oct 17 11:08:42 2011 Cannot open dh1024.pem for DH parameters:
error:02001002:system library:fopen:No such file or directory: error:
2006D080:BIO routines:BIO_new_file:no such file
Mon Oct 17 11:08:42 2011 Exiting

Joao Cardoso

unread,
Oct 17, 2011, 12:25:42 PM10/17/11
to al...@googlegroups.com
On Monday, October 17, 2011 16:58:33 Cam1878 wrote:
> Cannot open TUN/TAP dev /dev/net/tun:
> No such file or directory (errno=2)

but /dev/tun exists

> Mon Oct 17 10:30:07 2011 /sbin/ifconfig 10.8.0.1 pointopoint 10.8.0.2
> mtu 1500 ifconfig: SIOCSIFADDR: No such device

this must be because of the missing /dev/net/tun

perhaps you should use "-dev-node node"?
Explicitly set the device node rather than using /dev/net/tun,
/dev/tun, /dev/tap,
etc. If OpenVPN cannot figure out whether node is a TUN or TAP
device based on the
name, you should also specify --dev-type tun or --dev-type tap.

I notice just now that "--help" is not available on the shipped binary, I will
see if I can fix it.

Cam1878

unread,
Oct 17, 2011, 1:02:27 PM10/17/11
to Alt-F
I managed to solve the TUN problem in my earlier post. I think I may
have figured out the DH parameter problem but I'm no longer at my
computer. I'll try to keep working later today on it.

Once I followed the 4 commands on this page:
http://wiki.vpslink.com/TUN/TAP_device_with_OpenVPN_or_Hamachi
The error for opening TUN/TAP and the SIOCIFADDR was solved.
You are correct though, /dev/net/tun was missing.

The server.conf file sets whether the vpn is TUN or TAP. I have it set
to TUN currently

I am sure if it was set to TAP, it would have gotten the same error
looking in /dev/net/tap, so it is also probably missing.

Joao Cardoso

unread,
Oct 17, 2011, 1:53:26 PM10/17/11
to al...@googlegroups.com
On Monday, October 17, 2011 17:14:13 Cam1878 wrote:
>I currently have the dh1024.pem file in the same directory as the server.conf
>file andthe server keys.

You might then want to use "--cd /etc/openvpn", because files are there?

> Cannot open dh1024.pem for DH parameters:
> error:02001002:system library:fopen:No such file or directory: error

--cd dir
Change directory to dir prior to reading any files such as
configuration files, key
files, scripts, etc. dir should be an absolute path, with a
leading "/", and with-
out any references to the current directory such as "." or "..".

This option is useful when you are running OpenVPN in --daemon
mode, and you want
to consolidate all of your OpenVPN control files in one
location.

Joao Cardoso

unread,
Oct 17, 2011, 2:02:15 PM10/17/11
to al...@googlegroups.com
On Monday, October 17, 2011 17:14:13 Cam1878 wrote:
> I followed the solution here:
> http://wiki.vpslink.com/TUN/TAP_device_with_OpenVPN_or_Hamachi To create
> the TUN files.

That's OK as long as you remember it latter :)

But you should refrain from changing things that can be configured using
configuration files. Latter you will have to verify how to use the default
/dev/tun device.

I know, I'm picky ;-)

Cam1878

unread,
Oct 17, 2011, 5:06:04 PM10/17/11
to Alt-F
I modified server.conf to solve the DH parameter problem.

I editted "dh dh1024.pem" to "dh /etc/openvpn/dh1024.pem" to include
the filepath to where I had already saved the files.

Once I ran openvpn --config it returned this:

Mon Oct 17 14:46:55 2011 OpenVPN 2.2.1 arm-linux [SSL] [LZO2] [EPOLL]
[eurephia] built on Oct 12 2011
Mon Oct 17 14:46:55 2011 NOTE: your local LAN uses the extremely
common subnet address 192.168.0.x or 192.168.1.x. Be aware that this
might create routing conflicts if you connect to the VPN server from
public locations such as internet cafes that use the same subnet.
Mon Oct 17 14:46:55 2011 NOTE: OpenVPN 2.1 requires '--script-security
2' or higher to call user-defined scripts or executables
Mon Oct 17 14:46:56 2011 Diffie-Hellman initialized with 1024 bit key
Mon Oct 17 14:46:56 2011 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0
ET:0 EL:0 ]
Mon Oct 17 14:46:56 2011 Socket Buffers: R=[108544->131072] S=[108544-
>131072]
Mon Oct 17 14:46:56 2011 ROUTE default_gateway=192.168.0.1
Mon Oct 17 14:46:56 2011 TUN/TAP device tun0 opened
Mon Oct 17 14:46:56 2011 TUN/TAP TX queue length set to 100
Mon Oct 17 14:46:56 2011 /sbin/ifconfig tun0 10.8.0.1 pointopoint
10.8.0.2 mtu 1500
Mon Oct 17 14:46:56 2011 /sbin/route add -net 10.8.0.0 netmask
255.255.255.0 gw 10.8.0.2
Mon Oct 17 14:46:56 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42
EB:135 ET:0 EL:0 AF:3/1 ]
Mon Oct 17 14:46:56 2011 UDPv4 link local (bound): [undef]:1194
Mon Oct 17 14:46:56 2011 UDPv4 link remote: [undef]
Mon Oct 17 14:46:56 2011 MULTI: multi_init called, r=256 v=256
Mon Oct 17 14:46:56 2011 IFCONFIG POOL: base=10.8.0.4 size=62
Mon Oct 17 14:46:56 2011 IFCONFIG POOL LIST
Mon Oct 17 14:46:56 2011 Initialization Sequence Completed

So it seems to have initialized, I have yet to try to connect anything
yet.

Cam1878

unread,
Oct 18, 2011, 3:05:24 PM10/18/11
to Alt-F
After a bit of configuring on the client side of things, I managed to
connect to it perfectly.

It assigned me an IP and I was able to ping the server as well as
telnet to the device.

I'm going to try to change things around to set up network discovery
so I can use it as a network server as if it were on the same subnet.

Once it says initialization sequence completed you can just close the
SSH or telnet client and the vpn is running. I haven't set it up as a
daemon yet though.

Cam1878

unread,
Oct 18, 2011, 3:29:28 PM10/18/11
to Alt-F
I just looked in the files and noticed that /dev/tun or /dev/tap does
not exist.

I'm going to have to include the commands from here:
http://wiki.vpslink.com/TUN/TAP_device_with_OpenVPN_or_Hamachi in the
startup script.

Joao Cardoso

unread,
Oct 18, 2011, 4:22:14 PM10/18/11
to al...@googlegroups.com

They will be created as soon as you 'modprobe tun'. /dev/tun will be created by the tun kernel module, that is a tap/tun driver.

If it is absolutely necessary (i.e., the default can't be used throught the conf file) we can create /dev/net/tun and /dev/net/tap by using /etc/mdev.conf. I will take care of it, after you submit your initscript.

On Oct 18, 2011 8:29 PM, "Cam1878" <cameron...@gmail.com> wrote:

I just looked in the files and noticed that /dev/tun or /dev/tap does
not exist.

I'm going to have to include the commands from here:
http://wiki.vpslink.com/TUN/TAP_device_with_OpenVPN_or_Hamachi in the
startup script.

On Oct 17, 12:25 pm, Joao Cardoso <whoami.jc...@gmail.com> wrote: > On Monday, October 17, 2011 16:...

-- You received this message because you are subscribed to the Google Groups "Alt-F" group. To post...

Joao Cardoso

unread,
Oct 18, 2011, 4:26:29 PM10/18/11
to al...@googlegroups.com

To have the box dhcp server to be used, or other dhcp server in the box network, and be able to smb/nfs browse the box network,  the simplest is to use vpn in bridged mode.

Is that what you are doing now?

On Oct 18, 2011 8:05 PM, "Cam1878" <cameron...@gmail.com> wrote:

After a bit of configuring on the client side of things, I managed to
connect to it perfectly.

It assigned me an IP and I was able to ping the server as well as
telnet to the device.

I'm going to try to change things around to set up network discovery
so I can use it as a network server as if it were on the same subnet.

Once it says initialization sequence completed you can just close the
SSH or telnet client and the vpn is running. I haven't set it up as a
daemon yet though.

On Oct 17, 5:06 pm, Cam1878 <cameron.tetf...@gmail.com> wrote: > I modified server.conf to solve th...

Cam1878

unread,
Oct 18, 2011, 7:04:33 PM10/18/11
to Alt-F
Here is a step-by-step of what I did and the contents for server.conf
and S41openvpn

It is somewhat of a crude method of avoiding the tun & tap error,
you'll see it in the modified S41openvpn file. I'm sure you can modify
things to make it more polished and efficient.

1. Follow OpenVPN How-to: "Setting up your own Certificate Authority
(CA) and generating certificates and keys for an OpenVPN server and
multiple clients"

/Alt-F/usr/share/openvpn/easy-rsa/2.0 #Directory for creating keys

By now you should have:
ca.crt
ca.key
server.crt
server.key
dh1024.pem
clientX.crt
clientX.key

2. mkdir /Alt-F/openvpn #Directory for .conf, .key, and .crt files

3. Copy .crt and .key files and sample server.conf to /Alt-F/openvpn:
/Alt-F/usr/share/openvpn/sample-config-files #server.conf is found
here
/Alt-F/usr/share/openvpn/easy-rsa/2.0 #ca.crt and server.key is
found here
(Copy all client files to clients as needed - see How-to "Key Files"
chart for details)

4. Modify server.conf to (most are default values):
###### server.conf #######
local 192.168.0.XXX #Whichever IP the router is forwarding to
port 1194
proto udp
dev tap #Or "dev tun" depending on mode you want
ca /Alt-F/openvpn/ca.crt #IMPORTANT: direct to location of your .crt
and .key files
cert /Alt-F/openvpn/server.cert #SAME AS ABOVE
key /Alt-F/openvpn/server.key #SAME AS ABOVE
dh /Alt-F/openvpn/dh1024.pem #SAME AS ABOVE
server 10.8.0.0 255.255.255.0
ifconfig-poo-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
############################

5. Copy S41openvpn file to /etc/init.d (contents shown below)
###### S41openvpn #######
#!/bin/sh
initTunAndTap() {
mkdir -p /dev/net
mknod /dev/net/tun c 10 200
mknod /dev/net/tap c 10 200
chmod 600 /dev/net/tun
chmod 600 /dev/net/tap
}
DESC="openvpn daemon"
NAME=openvpn
TYPE=net
OPENVPN_OPTS="--config /Alt-F/openvpn/server.conf"
. $(dirname $0)/common
case "$1" in
start) initTunAndTap; start $NAME -- $OPENVPN_OPTS ;;
stop) stop $NAME ;;
status) status $NAME ;;
reload) reload $NAME ;;
restart) restart $NAME ;;
esac
############################

6. rcopenvpn start #Should result in something similar to below

Sun Feb 6 20:46:38 2005 OpenVPN 2.0_rc12 i686-suse-linux [SSL] [LZO]
[EPOLL] built on Feb 5 2005
Sun Feb 6 20:46:38 2005 Diffie-Hellman initialized with 1024 bit key
Sun Feb 6 20:46:38 2005 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0
ET:0 EL:0 ]
Sun Feb 6 20:46:38 2005 TUN/TAP device tun1 opened
Sun Feb 6 20:46:38 2005 /sbin/ifconfig tun1 10.8.0.1 pointopoint
10.8.0.2 mtu 1500
Sun Feb 6 20:46:38 2005 /sbin/route add -net 10.8.0.0 netmask
255.255.255.0 gw 10.8.0.2
Sun Feb 6 20:46:38 2005 Data Channel MTU parms [ L:1542 D:1450 EF:42
EB:23 ET:0 EL:0 AF:3/1 ]
Sun Feb 6 20:46:38 2005 UDPv4 link local (bound): [undef]:1194
Sun Feb 6 20:46:38 2005 UDPv4 link remote: [undef]
Sun Feb 6 20:46:38 2005 MULTI: multi_init called, r=256 v=256
Sun Feb 6 20:46:38 2005 IFCONFIG POOL: base=10.8.0.4 size=62
Sun Feb 6 20:46:38 2005 IFCONFIG POOL LIST
Sun Feb 6 20:46:38 2005 Initialization Sequence Completed

Cam1878

unread,
Oct 18, 2011, 7:10:29 PM10/18/11
to Alt-F
Also, openvpn shows up in the services -> network list now.

I tested starting it from the browser and it works, mine now starts on
boot.

Joao Cardoso

unread,
Oct 18, 2011, 7:50:00 PM10/18/11
to al...@googlegroups.com

Good work.

I'm certain that I will need your help to create a GUI.

There are however some problems with your approach. You should not use the /Alt-F path in any circunstance.
I can't give more details by now.

Thanks.

-- You received this message because you are subscribed to the Google Groups "Alt-F" group. To pos...

Cam1878

unread,
Oct 18, 2011, 7:55:37 PM10/18/11
to Alt-F
I had actually just finished moving everything to /etc/openvpn as I
read the message. Everything is located there now.

On Oct 18, 7:50 pm, Joao Cardoso <joao.fs.card...@gmail.com> wrote:
> Good work.
>
> I'm certain that I will need your help to create a GUI.
>
> There are however some problems with your approach. You should not use the
> /Alt-F path in any circunstance.
> I can't give more details by now.
>
> Thanks.
>

Cam1878

unread,
Oct 18, 2011, 9:34:51 PM10/18/11
to Alt-F
I modified the server.conf file to use

server-bridge 192.168.0.1 255.255.255.0 192.168.0.XXX 192.168.0.YYY

instead of

server 10.8.0.0 255.255.255.0

Now the connected clients have IP's in the same subnet as my network.
It must be noted that the IP pool between XXX and YYY must be out of
the range of the DHCP server's IP pool.

I have yet to create an actual bridge between tap0 and eth0 though.
Once that is made the clients should be able to see the other side of
the VPN.

Cam1878

unread,
Oct 18, 2011, 9:48:13 PM10/18/11
to Alt-F
Is the package "bridge-utils" included in Alt-F?

I found the download link from linuxfoundation.org and it redirected
to here:

http://sourceforge.net/projects/bridge/files/bridge/

I don't know how to compile package files to install them on the
DNS-323.

It's needed by the bridge-start script mentioned on this page:

http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html

From what it seems like, that script will need to be run at
initialization each time the NAS boots or the first time openvpn
starts.

Joao Cardoso

unread,
Oct 19, 2011, 10:23:38 AM10/19/11
to Alt-F


On Oct 19, 2:48 am, Cam1878 <cameron.tetf...@gmail.com> wrote:
> Is the package "bridge-utils" included in Alt-F?

Not at the time you wrote :-)

I have now compiled and tested it (but it is not yet available at the
feed).

The problem is the 'bridge' kernel module, needed by the bridge-utils
package.
I compiled the kernel module and updated the kernel-modules package
(not yet available at the feed), but the RC1 kernel refuses to load
it.

I have to see what is happening, but initial tests show that the RC1
kernel will not be able to use it, I will have to release RC2.

Keep tuned.
For now you will have to use the routed mode.

There is one think that I would like to have, user/pass only
authentication. From the HOWTO it seems to be possible, and I think it
is convenient, as you might not always have the client certificate
with you.

I was thinking to have three authentication methods: certificate only
(one certificate per client), certificate and user/pass (one
certificate for all clients), and user/pass only. What do you think
about this?

> I found the download link from linuxfoundation.org and it redirected
> to here:
>
> http://sourceforge.net/projects/bridge/files/bridge/
>
> I don't know how to compile package files to install them on the
> DNS-323.
>
> It's needed by the bridge-start script mentioned on this page:
>
> http://openvpn.net/index.php/open-source/documentation/miscellaneous/...
>
> From what it seems like, that script will need to be run at
> initialization each time the NAS boots or the first time openvpn
> starts.

That's pretty simple, I only hope that 'iptables' is not needed.

Cam1878

unread,
Oct 19, 2011, 12:08:05 PM10/19/11
to Alt-F

> I was thinking to have three authentication methods: certificate only
> (one certificate per client), certificate and user/pass (one
> certificate for all clients), and user/pass only. What do you think
> about this?

1. Certificate and key only will work as that is what I'm using
currently.

2. Certificate and user/pass is possible according to the how-to, it
doesn't seem too hard to set up

3. It is possible to use only user/pass, but according to the how to,
ca.crt will still be needed because the client needs to authenticate
the server when it connects.

From the How-to: "Note that client-cert-not-required will not obviate
the need for a server certificate, so a client connecting to a server
which uses client-cert-not-required may remove the cert and key
directives from the client configuration file, but not the ca
directive, because it is necessary for the client to verify the server
certificate."

If you want you can enable this option, but you will still need a
specific file to connect.

I haven't found a way to disable the dual-authentication (client
authenticates server as well) feature.

Joao Cardoso

unread,
Oct 19, 2011, 12:49:05 PM10/19/11
to al...@googlegroups.com
On Wednesday, October 19, 2011 17:08:05 Cam1878 wrote:
> > I was thinking to have three authentication methods: certificate only
> > (one certificate per client), certificate and user/pass (one
> > certificate for all clients), and user/pass only. What do you think
> > about this?
>
> 1. Certificate and key only will work as that is what I'm using
> currently.
>
> 2. Certificate and user/pass is possible according to the how-to, it
> doesn't seem too hard to set up
>
> 3. It is possible to use only user/pass, but according to the how to,
> ca.crt will still be needed because the client needs to authenticate
> the server when it connects.
>
> From the How-to: "Note that client-cert-not-required will not obviate
> the need for a server certificate, so a client connecting to a server
> which uses client-cert-not-required may remove the cert and key
> directives from the client configuration file, but not the ca
> directive, because it is necessary for the client to verify the server
> certificate."

hmm, ok.
Perhaps big organizations can sign their certificates using a well-know CA, so
that clients can automatically verify its authenticity?
Or just make ca.crt public? In a web page? Clients wouldn't be able to verify
that the server they are connecting to is indeed the one they desire? No,
because the in-the-midle-server miss the correct ca.key, right?

Oh well, I need to make a workshop on certificates and security :-

Have you tried to use a commercial VPN client to connect? Being limited to the
openVPN client is a severe restriction.

You see, I might be using a friend's laptop, with MS-W on it :-(

Thanks

Cam1878

unread,
Oct 19, 2011, 1:20:40 PM10/19/11
to Alt-F
I'm not sure if you're able to use other clients, you'd have to google
it to find out.

If you want something more generic I know there were some threads on
the forum about trying to get a PPTP vpn server running.

This is the one they were trying to use: http://poptop.sourceforge.net/
It's an open source linux pptp server.

With that it would just be user/pass, and then you could use the built-
in windows or any other pptp client to connect. I know android devices
have integrated clients as well.

Cam1878

unread,
Oct 19, 2011, 1:36:21 PM10/19/11
to Alt-F
The easiest solution would be to use something like this:

http://sourceforge.net/projects/ovpnp/

And run the openvpn client off of a USB drive.

I would advise to use certificate and user/pass otherwise if anyone
managed to get a hold of your drive, they could log in to your network.

Joao Cardoso

unread,
Oct 20, 2011, 2:53:05 PM10/20/11
to Alt-F


On Oct 19, 3:23 pm, Joao Cardoso <whoami.jc...@gmail.com> wrote:
> On Oct 19, 2:48 am, Cam1878 <cameron.tetf...@gmail.com> wrote:
>
> > Is the package "bridge-utils" included in Alt-F?
>
> Not at the time you wrote :-)
>
> I have now compiled and tested it (but it is not yet available at the
> feed).
>
> The problem is the 'bridge' kernel module, needed by the bridge-utils
> package.
> I compiled the kernel module and updated the kernel-modules package
> (not yet available at the feed), but the RC1 kernel refuses to load
> it.

Problem solved. Well, hacked...

Meanwhile I start looking for possible performance issues.
Everybody knows that ssh file transfer is slow, because of the SSL
encryption used by ssh.
What not everybody knows is that our little box has a hardware crypto
engine on it. Unused!

For the cryptsetup package, that encrypts physical partitions, I was
able to use the hw crypto engine, with a not so-so significative
performance improvement, "only" twice faster (but still 3-4 times
slower than a non-encrypted partition)

So, why not to use the hw crypto with SSL, benefiting both ssh and
openvpn?
Well, it is working, with some 23X performance improvement (on certain
circumstances)

No hardware acceleration:
type 16 bytes 64 bytes 256 bytes 1024
bytes 8192 bytes
aes-256 cbc 3058.84k 3380.65k 3508.31k 3550.09k
3530.75k
aes-128-cbc 3281.25k 4232.38k 4645.72k 4772.39k
4786.86k

With hardware acceleration:
type 16 bytes 64 bytes 256 bytes 1024
bytes 8192 bytes
aes-256 cbc 2973.93k 3384.96k 3510.27k 3538.26k
3522.56k
aes-128-cbc 12210.67k 28837.12k 25379.35k 49702.84k
110829.83k

The hw does not accelerate aes-256, but for aes-128 we have a 23 fold
speed improvement! Even for small block sizes, the improvement is
almost 4 times.

The next challenge is to see if I can fit this in the available flash
memory space. I doubt.

> I have to see what is happening, but initial tests show that the RC1
> kernel will not be able to use it, I will have to release RC2.

Or "release" a snapshoot meanwhile, if you want to keep exploring
(helping me with) openvpn

Cam1878

unread,
Oct 20, 2011, 6:08:37 PM10/20/11
to Alt-F
Do you think there is any chance of including the pptp server in it as
well as an alternative to openvpn?

I've got a galaxy tab 10.1 that I am trying to connect but I can't get
openvpn to work on it (i'm getting the tun/tap error but the fix I had
doesn't work on android).
I was able to make a pptp connection to my laptop though.

If both openvpn and pptp were running it would allow a user/pass only
connection as well. I would say its one of the most common types of
vpns, it would probably be worthwhile.

However we should keep trying to get openvpn working first before
another task is added on.

Also as a side question,

Do you know an alternate way of avoiding the tun/tap error? I'd really
like to try to fix it on my android
Message has been deleted

Joao Cardoso

unread,
Oct 21, 2011, 11:45:51 AM10/21/11
to al...@googlegroups.com
On Friday, October 21, 2011 14:09:55 Cam1878 wrote:
> Wow...it really shows the benefits of having hardware acceleration.
>
> I tried the OpenVPN portable and it works fine, I just put a portable
> encryption program on my USB drive to secure the .conf, .crt, and .key
> files
>
> Did you get a chance to look at the pptp server? Or would it be too
> much work for this release?

No, I haven't, still busy integrating cryptodev, kernel modules and openssl;
and latter with openvnp, bridge-utill, initscripts and web pages.

There is a difference between a demo prototype, glued together with wires and
duct tape, and a user working solution ;-)

> I can't get openvpn to work on my Android tablet so I'm trying to look
> for alternatives for it. It works fine on my laptop though.

Looks like you have to "root" your android first. I haven't done it yet to
mine.

> I tried looking at how the GUI works for some of the other services
> but I don't know enough about html to get started on it.

Design a layout based on common needs would be possible:

Keys management:
-generate server CA button
-generate client key |client name entry field | generate button | revoke
button

Autentication:
-certificate only radiobutton | certificate and user/pass radiobutton | user-
pass only radiobutton (not possible in near future, requires PAM)

-routing radiobutton | bridged radiobutton

and so on. Complete but not overwhelming. Ah, and write the help page :-)

I'm sure it will not be as simple and complete as I would like, it takes too
long to put it all together and test everything.

Cam1878

unread,
Oct 21, 2011, 12:03:13 PM10/21/11
to Alt-F
It is rooted.

I managed to get around the tun/tap error by doing insmod tun.ko

But now I have another error saying "Linux ifconfig failed: external
program fork failed" do you happen to know what that would mean?
Google wasn't very helpful

Oh well, I'll probably figure it out eventually.

As for the GUI, when the CA, server, and client keys are made, it runs
through a script setting parameters, I don't know how you would want
show that on the webpage, it isn't as simple as just running a file.
The buttons for certificate/user-pass/others will have to edit
different lines in the .conf file, but that should be possible.

Another option is to have the ability of the webpage having a link to
"download" the client files and config to whoever is viewing it.
Otherwise it needs to be manually transferred.

There also needs to be options like setting the IP pool for the server
as well.

Cam1878

unread,
Oct 26, 2011, 1:02:11 PM10/26/11
to Alt-F
> No, I haven't, still busy integrating cryptodev, kernel modules and openssl;
> and latter with openvnp, bridge-utill, initscripts and web pages.
>
> There is a difference between a demo prototype, glued together with wires and
> duct tape, and a user working solution ;-)

Any ETA on an update or new release that includes the above packages?
I'd like to try testing out some of them.

Joao Cardoso

unread,
Oct 26, 2011, 2:04:54 PM10/26/11
to Alt-F
The Crypto Hardware Accelerator was a flop.

After installing Cryptodev and updating to openssl-1.0, so that all
ssl-enabled apps could use the crypto engine, it turns out that there
is a bug that avoids its usage on some cyphers/digests.
alg: hash: Test 6 failed for mv-hmac-sha1

So, the hardware crypto engine and ssl infrastructure is ready and
working, but can't be used with confidence.
Fortunately enough software can still be used as a fallback, so I will
restart openvpn work after finishing some open issues.

I will announce the snapshot and accompanying packages ASAP.


Joao Cardoso

unread,
Apr 13, 2012, 11:30:36 AM4/13/12
to al...@googlegroups.com
Have you done any progress on openVPN, now that the bridge package and  kernel module are available for RC2?

didier belin

unread,
Oct 13, 2012, 4:15:07 PM10/13/12
to al...@googlegroups.com
openvpn works and with bridge it seems to work also. More tests on monday.

didier belin

unread,
Dec 12, 2012, 8:29:16 AM12/12/12
to al...@googlegroups.com
bridge version works fine since 2 months.
No time for make scripts to run openvpn at startup time.
But if someone wants my configuration files...

Joao Cardoso

unread,
Dec 12, 2012, 7:38:16 PM12/12/12
to al...@googlegroups.com


On Wednesday, December 12, 2012 1:29:16 PM UTC, didier belin wrote:
bridge version works fine since 2 months.
No time for make scripts to run openvpn at startup time.
But if someone wants my configuration files...

please do. But please explain your setup, as there are several possible setups.

didier belin

unread,
Jan 2, 2013, 5:59:01 PM1/2/13
to al...@googlegroups.com
Sorry, I see your msg only now. I'll post my configuration with comments this WE.

medoc

unread,
Oct 15, 2013, 2:19:54 PM10/15/13
to al...@googlegroups.com
Hi,

what is the status of this?

I have managed to set up tun mode (TAP is not available via iOS:() and connect to the server remotely.

I was not able however to set up the network in a way that I reach the LAN from outside.

I use the default 10.... virtual IP for the VPN and 192.168.1. network for the LAN.

Can someone explain how to set up routing between the two in order to reach the internal network - not just the NAS - from outside?

Thanks,
medoc

michae...@googlemail.com

unread,
Feb 24, 2014, 4:43:59 AM2/24/14
to
Hi,
just wanted to mention that I got this working too. Using version 0.1RC3
It did need a little twittling, since apparently the tun-device is not created by OpenVPN as it should be. To get around this I used the instructions in the link given by Cam1878: http://wiki.vpslink.com/TUN/TAP_device_with_OpenVPN_or_Hamachi

So supposing you have a working OpenVPN config file (which I had confirmed previously with a PC), the steps are (this is basically just a summary of the things mentioned in this thread):

1) install the Alt-F openvpn package
2) load the tun module: >> modprobe tun
3) create the tunnel device (from link above):
>> mkdir -p /dev/net
>> ls /dev/net # confirm it's working (see link)

>> mknod /dev/net/tun c 10 200
>> chmod 600 /dev/net/tun
4) start OpenVPN:
>> openvpn --config client.conf

If the tun-device is not created manually, then OpenVPN will initialize fine (given a correct config), but will fail when creating the tun-device with the message:
  Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
  ifconfig: SIOCSIFADDR: No such device
  Linux ifconfig failed: external program exited with error status: 1
  Exiting

It would be nice, if we could work out, why OpenVPN can't create the tun-device by itself, as it usually should.

João Cardoso

unread,
Feb 24, 2014, 11:20:44 AM2/24/14
to al...@googlegroups.com


On Monday, February 24, 2014 9:42:36 AM UTC, michae...@googlemail.com wrote:
Hi,
just wanted to mention that I got this working too. Using version 0.1RC3
It did need a little twittling, since apparently the tun-device is not created by OpenVPN as it should be. To get around this I used the instructions in the link given by Cam1878: http://wiki.vpslink.com/TUN/TAP_device_with_OpenVPN_or_Hamachi

So supposing you have a working OpenVPN config file (which I had confirmed previously with a PC), the steps are (this is basically just a summary of the things mentioned in this thread):

1) install the Alt-F openvpn package
2) load the tun module: >> modprobe tun
3) create the tunnel device (from link above):
>> mkdir -p /dev/net
>> ls /dev/net # confirm it's working (see link)
>> mknod /dev/net/tun c 10 200
>> chmod 600 /dev/net/tun
4) start OpenVPN:
>> openvpn --config client.conf

If the tun-device is not created manually, then OpenVPN will initialize fine (given a correct config), but will fail when creating the tun-device with the message:
  Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
  ifconfig: SIOCSIFADDR: No such device
  Linux ifconfig failed: external program exited with error status: 1
  Exiting

It would be nice, if we could work out, why OpenVPN can't create the tun-device by itself, as it usually should.

Can you please add the following line to the end of /etc/mdev.conf

(tun|tap) 0:0 660 =net/%1

and then,

modprobe -r tun
rm
-rf /dev/net
modprobe tun

and see if the devices are created at 'modprobe' time?
Does it also works for the 'tap' mode of operation, or a /dev/net/tap device has to be explicitly created?

I still think that 'modprobe' should be performed by openvpn itself...


michae...@googlemail.com

unread,
Feb 26, 2014, 8:21:52 AM2/26/14
to
Hi.
So it took a while. But I can confirm that modifying /etc/mdev.conf as you stated and redoing modprobe solves it.
Now OpenVPN is able to create the tun as well as the tap devices, when initializing a connection.

Only question now is how to 'modprobe tun' by default and have OpenVPN run at start-up (and daemon mode to keep it alive), so that the connection is setup by default after restarting.

Edit: Forgot to mention. In my limited testing it solves it also solves it for tap devices (I usually only use tun).

João Cardoso

unread,
Feb 26, 2014, 12:16:19 PM2/26/14
to


On Wednesday, February 26, 2014 9:45:26 AM UTC, michae...@googlemail.com wrote:
Hi.
So it took a while. But I can confirm that modifying /etc/mdev.conf as you stated and redoing modprobe solves it.
Now OpenVPN is able to create the tun as well as the tap devices, when initializing a connection.

Only question now is how to 'modprobe tun' by default and have OpenVPN run at start-up (and daemon mode to keep it alive), so that the connection is setup by default after restarting.

Please try the attached initscript. In order for it to be persistent across reboots you must have Alt-F packages installed, 'ipkg' itself is enough.
Uncompress the file and put it under /etc/init.d/ and "openvpn" should appear under Services->Network. The script assumes that keys reside in /etc/openvpn. Is that sensible or customary? I don't know.
Also, in /etc/openvpn/server.conf you must add /etc/openvpn/ to the relevant keys:

ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key  # This file should be kept secret
dh /etc/openvpn/dh1024.pem

At "stop" time 'modprobe -r' is executed, which is not failsafe, but I don't like to have unnecessary modules loaded.

S41openvpn.gz

michae...@googlemail.com

unread,
Mar 3, 2014, 5:01:21 AM3/3/14
to al...@googlegroups.com
Ok. So I finally got around to trying this.
In principle the script works, but it's not optimal, since you make it hard-wired to the config file-name 'server.conf'.
In my case I am running openvpn on my NAS as the client of another server and aptly named the config-file 'client.conf'. I changed your script and remove the checks for the keys and then it worked nicely.
It gets problematic, if you have multiple config files, which can be the case if the NAS is a client and a server or a client to multiple VPNs.
I looked at the init-script of Raspbian on the Raspberry and they run openpvn for all config-files: /etc/openvpn/*.conf, which is perhaps what this script should also do. It would also require removing the checks for the config-files in /etc/openvpn/, which also aren't ideal, if for example you have server and client configs at the same time and would have the keys nicely separated in /etc/openvpn/server_keys and /etc/openvpn/client_keys.
But for the time being this script works perfectly for me. Just bringing in suggestions... :)
Thanks for all your hard work. Alt-F is really, really nice!

João Cardoso

unread,
Mar 6, 2014, 2:21:28 PM3/6/14
to al...@googlegroups.com


On Monday, March 3, 2014 10:01:21 AM UTC, michae...@googlemail.com wrote:
Ok. So I finally got around to trying this.
In principle the script works, but it's not optimal, since you make it hard-wired to the config file-name 'server.conf'.
In my case I am running openvpn on my NAS as the client of another server and aptly named the config-file 'client.conf'. I changed your script and remove the checks for the keys and then it worked nicely.
It gets problematic, if you have multiple config files, which can be the case if the NAS is a client and a server or a client to multiple VPNs.
I looked at the init-script of Raspbian on the Raspberry and they run openpvn for all config-files: /etc/openvpn/*.conf, which is perhaps what this script should also do. It would also require removing the checks for the config-files in /etc/openvpn/, which also aren't ideal, if for example you have server and client configs at the same time and would have the keys nicely separated in /etc/openvpn/server_keys and /etc/openvpn/client_keys.
But for the time being this script works perfectly for me. Just bringing in suggestions... :)

Thanks. The attached script should cover all your suggestions.

S41openvpn.gz

AZ

unread,
Dec 17, 2017, 10:02:44 PM12/17/17
to Alt-F
Hello, I am new to Alt-F and would like to start openvpn and connect to my vpn provider automatically. I did copy and unzip the attached script and reboot my device, in the network services openvpn daemon still stopped, and cannot start it, error message is S41openvpn : you must configure openvpn first

João Cardoso

unread,
Dec 20, 2017, 1:18:38 PM12/20/17
to Alt-F


On Monday, 18 December 2017 03:02:44 UTC, AZ wrote:
Hello, I am new to Alt-F and would like to start openvpn and connect to my vpn provider automatically. I did copy and unzip the attached script and reboot my device, in the network services openvpn daemon still stopped, and cannot start it, error message is S41openvpn : you must configure openvpn first

There is no webUI for openvpn, you have to create and hand edit its configuration file.
There are several sample configuration files under /usr/share/openvpn/sample-config-files/ and several tutorials around.

Vincent Loubry

unread,
Jan 8, 2018, 5:07:27 PM1/8/18
to Alt-F
Hello,

I trying to make openVPN working. I did it previously on Debian and now I m trying on Alt-F.
When I try to modprobe tun, I got modprobe: module tun not found in modules.dep
I m running Alt-F 1.
I have tried to build tun like Cam said. His link is dead.

I need a little help please.

Thanks you

Vincent

João Cardoso

unread,
Jan 9, 2018, 10:30:23 AM1/9/18
to Alt-F


On Monday, 8 January 2018 22:07:27 UTC, Vincent Loubry wrote:
Hello,

I trying to make openVPN working. I did it previously on Debian and now I m trying on Alt-F.
When I try to modprobe tun, I got modprobe: module tun not found in modules.dep
I m running Alt-F 1.

On a DNS-321/323, right?
If that is the case you need to install the kernel-modules-armv5 and kernel-modules  Alt-F packages

Vincent Loubry

unread,
Jan 9, 2018, 1:44:35 PM1/9/18
to Alt-F
Hello João,

Thank you or your reply. Yes I got a DNS-323. I already installed the mentioned packages.
I don't know why I can't modprobe tun.

Vincent

João Cardoso

unread,
Jan 9, 2018, 2:03:38 PM1/9/18
to al...@googlegroups.com


On Tuesday, 9 January 2018 18:44:35 UTC, Vincent Loubry wrote:
Hello João,

Thank you or your reply. Yes I got a DNS-323. I already installed the mentioned packages.
I don't know why I can't modprobe tun.

I can't reproduce that.
I just turned on my DNS-323-revB with Alt-F-1.0 (*not* 0.1RC1 as the topic subject implies...), freshly installed Alt-F packages, then installed kernel-modules-armv5, kernel-modules, openvpn, everything using the webUI, then on the command line:

[root@DNS-323]# lsmod 
Module                  Size  Used by    Not tainted
usblp                   8000  0 
 
[root@DNS-323]# modprobe tun
[root@DNS-323]# lsmod 
Module                  Size  Used by    Not tainted
tun                    15488  0 
usblp                   8000  0 

just to confirm:

[root@DNS-323]# ls -l /dev/net/
total 0
crw-rw----    1 root     root       10, 200 Jan  9 18:51 tun
 
[root@DNS-323]# ls -l /lib/modules/4.4.86/kernel/drivers/net/tun.ko
-rw-r--r--    1 root     root         25750 Sep 22 20:56 /lib/modules/4.4.86/kernel/drivers/net/tun.ko

[root@DNS-323]# ipkg list_installed | grep -E modules\|vpn
kernel-modules - 4.4.86 - 
kernel-modules-armv5 - 4.4.86 - 
openvpn - 2.2.1-3 - 

What have you done differently?
Notice that I have no experience with openvpn itself.

Vincent Loubry

unread,
Jan 9, 2018, 3:14:20 PM1/9/18
to Alt-F
We are talking about Alt-F 1.0.

This is what I got :

[root@zeNAS]# cd /lib/modules/4.4.86/kernel/drivers/net/
[root@zeNAS]# ls
mii.ko    ppp       slip      tun.ko    usb       wireless

Ok, I got it.
Now :

[root@zeNAS]# modprobe tun.ko
modprobe: module tun.ko not found in modules.dep


So, tun.ko is not in modules.dep
Ok, I asked myself which kernel I use :

uname -a
Linux zeNAS 4.4.45 #1 Wed Jun 14 15:41:08 WEST 2017 armv5tel GNU/Linux


And if the module wasn't present in this kernel :

[root@zeNAS]# ls /lib/modules/4.4.45/kernel/drivers/
usb


I don't know why I boot with wrong kernel. I rebooted my NAS and I m still in 4.4.45.
I tried to move the content of kernel 4.4.86 to 4.4.45 and of course that didn't work (I overwrited the usb folder by doing this, shit! I hope it's not important)
 I have to try to boot in 4.4.86.

Thank you

Vincent



Joao Cardoso

unread,
Jan 9, 2018, 4:05:27 PM1/9/18
to Alt-F Group


On Jan 9, 2018 8:14 PM, "Vincent Loubry" <vlo...@gmail.com> wrote:
We are talking about Alt-F 1.0.

This is what I got :

[root@zeNAS]# cd /lib/modules/4.4.86/kernel/drivers/net/
[root@zeNAS]# ls
mii.ko    ppp       slip      tun.ko    usb       wireless

Ok, I got it.
Now :

[root@zeNAS]# modprobe tun.ko
modprobe: module tun.ko not found in modules.dep


So, tun.ko is not in modules.dep
Ok, I asked myself which kernel I use :

uname -a
Linux zeNAS 4.4.45 #1 Wed Jun 14 15:41:08 WEST 2017 armv5tel GNU/Linux

You must have flashed the 1.0 *snapshot*. Flash the final 1.0

--
You received this message because you are subscribed to the Google Groups "Alt-F" group.
To unsubscribe from this group and stop receiving emails from it, send an email to alt-f+unsubscribe@googlegroups.com.
Visit this group at https://groups.google.com/group/alt-f.
For more options, visit https://groups.google.com/d/optout.

Vincent Loubry

unread,
Jan 9, 2018, 5:29:02 PM1/9/18
to Alt-F
Oh OK ! I understand. I've just downloaded a new firmware from sourceforge. I ll install it asap. The NAS is 200km far from me, but like I have an ssh access so I can make a tunnel.
Does the update keep my presets and files ?

Thank for all. I ll keep you up to date.


You must have flashed the 1.0 *snapshot*. Flash the final 1.0



Vincent 

João Cardoso

unread,
Jan 10, 2018, 12:30:25 PM1/10/18
to Alt-F


On Tuesday, 9 January 2018 22:29:02 UTC, Vincent Loubry wrote:
Oh OK ! I understand. I've just downloaded a new firmware from sourceforge. I ll install it asap. The NAS is 200km far from me, but like I have an ssh access so I can make a tunnel.
Does the update keep my presets and files ?

Yes.
Please read the release README file (particularly the last paragraph)

Vincent Loubry

unread,
Feb 5, 2018, 4:50:35 PM2/5/18
to Alt-F
Hello,

Sorry for the long time reply. I flashed the NAS, and now, everthing is alright. My router is connected to my daughter NAS permanently. For the tips, as my router is a Mikrotik, I have to use OpenVPN over TCP instead UDP.
A big thank to you.

Vincent
Reply all
Reply to author
Forward
0 new messages